IdentityModel 7.0.0 is a major release of IdentityModel. Highlights of this release include:

• Support for RFC 9126 - Pushed Authorization Requests (PAR)
• Cleanup of dependencies
• A README in the github repo and nuget package

What's Changed

Breaking changes

• Support for .NET Framework 4.6.1 has been dropped, as it has not been supported by Microsoft since April 26, 2022.
• Dynamic client registration extension data is now modeled as a Dictionary<string, JsonElement>. This makes the dcr extension data serializable with source generated JSON serialization
• Parameters.AddRequired is now more forgiving of some edge cases. In particular, a call to AddRequired with an existing key but a missing value does not fail, nor will a call with an existing key and value. The intention is to make AddRequired simpler to use when merging values from a request object model into the parameters dictionary.
• We now depend on System.Text.Json version >= 8.0.0 in all .NET Framework builds. .NET builds don't need an explicit dependency.

New Feature

• PAR Support by @josephdecock in #551

Fixes and Improvements

• Improve nullable annotations for IsMissing/IsPresent string extensions by @0xced in #526
• Add trimmable analysis project by @josephdecock in #546
• Add "roles" to standard claim types by @leverse-tjip in #519
• Change to Dictionary<string, JsonElement> for DCR extension data by @josephdecock in #540
• Expand readme and add to nuget package by @josephdecock in #559
• Make raw response available from non-json userinfo responses by @josephdecock in #556
• Error Handling Improvements by @josephdecock in #564

Dependency Updates

External Dependencies

• Update System.Text.Json version by @josephdecock in #552
• Remove support for .NET 4.6.1 by @josephdecock in #566

Internal Dependencies (used in build and test, but won't affect end users)

• Bump Microsoft.NET.Test.Sdk from 17.3.0 to 17.7.0 by @dependabot in #525
• Bump xunit from 2.4.2 to 2.5.0 by @dependabot in #522
• Bump xunit from 2.5.0 to 2.6.6 by @dependabot in #547
• Bump xunit from 2.6.6 to 2.7.0 by @dependabot in #562
• Bump xunit.runner.visualstudio from 2.4.5 to 2.5.6 by @dependabot in #542
• Bump xunit.runner.visualstudio from 2.5.6 to 2.5.7 by @dependabot in #561
• Bump Microsoft.NET.Test.Sdk from 17.7.0 to 17.8.0 by @dependabot in #536
• Bump Microsoft.NET.Test.Sdk from 17.8.0 to 17.9.0 by @dependabot in #554
• Bump Microsoft.SourceLink.GitHub from 1.1.1 to 8.0.0 by @dependabot in #537

New Contributors

• @0xced made their first contribution in #526
• @leverse-tjip made their first contribution in #519

Full Changelog: 6.2.0...7.0.0

Our latest preview of IdentityModel 7 builds on the previous previews, improves error handling, cleans up some dependencies, and adds a nice README to the package. We now no longer support .NET Framework 4.6.1 (which is also not supported by Microsoft).

What's Changed

• Bump Microsoft.NET.Test.Sdk from 17.8.0 to 17.9.0 by @dependabot in #554
• Expand readme and add to nuget package by @josephdecock in #559
• Update System.Text.Json version by @josephdecock in #552
• Make raw response available from non-json userinfo responses by @josephdecock in #556
• Bump xunit from 2.6.6 to 2.7.0 by @dependabot in #562
• Bump xunit.runner.visualstudio from 2.5.6 to 2.5.7 by @dependabot in #561
• Error Handling Improvements by @josephdecock in #564
• Remove support for .NET 4.6.1 by @josephdecock in #566

Full Changelog: 7.0.0-preview.1...7.0.0-preview.4

This is a preview of a major release of IdentityModel, bringing support for RFC 9126 - Pushed Authorization Requests (PAR), bug fixes and updates.

What's Changed

Breaking changes

• Dynamic client registration extension data is now modeled as a Dictionary<string, JsonElement>. This makes the dcr extension data serializable with source generated JSON serialization
• Parameters.AddRequired is now more forgiving of some edge cases. In particular, a call to AddRequired with an existing key but a missing value does not fail, nor will a call with an existing key and value. The intention is to make AddRequired simpler to use when merging values from a request object model into the parameters dictionary.

New Feature

• PAR Support by @josephdecock in #551

Fixes and Improvements

• Improve nullable annotations for IsMissing/IsPresent string extensions by @0xced in #526
• Add trimmable analysis project by @josephdecock in #546
• Add "roles" to standard claim types by @leverse-tjip in #519
• Change to Dictionary<string, JsonElement> for DCR extension data by @josephdecock in #540

Dependency Updates

• Bump Microsoft.NET.Test.Sdk from 17.3.0 to 17.7.0 by @dependabot in #525
• Bump xunit from 2.4.2 to 2.5.0 by @dependabot in #522
• Bump xunit from 2.5.0 to 2.6.6 by @dependabot in #547
• Bump xunit.runner.visualstudio from 2.4.5 to 2.5.6 by @dependabot in #542
• Bump Microsoft.NET.Test.Sdk from 17.7.0 to 17.8.0 by @dependabot in #536
• Bump Microsoft.SourceLink.GitHub from 1.1.1 to 8.0.0 by @dependabot in #537

New Contributors

• @0xced made their first contribution in #526
• @leverse-tjip made their first contribution in #519

Full Changelog: 6.2.0...7.0.0-preview.1

What's Changed

• Enable Trimmable Assembly by @mwasplund in #524

New Contributors

• @mwasplund made their first contribution in #524

Full Changelog: 6.1.0...6.2.0

What's Changed

• Bump Microsoft.NET.Test.Sdk from 17.0.0 to 17.1.0 by @dependabot in #441
• Bump minver from 3.0.0-alpha.1 to 3.0.0-rc.2 by @dependabot in #443
• Bump minver from 3.0.0-rc.2 to 3.0.0 by @dependabot in #445
• Bump xunit.runner.visualstudio from 2.4.3 to 2.4.5 by @dependabot in #451
• Bump Microsoft.NET.Test.Sdk from 17.1.0 to 17.2.0 by @dependabot in #452
• Bump xunit from 2.4.1 to 2.4.2 by @dependabot in #464
• Update JsonWebKeySet with RawData property by @ariveron in #463
• Don't wrap OperationCanceledException in a protocol response by @MatthewSteeples in #460
• Bump Microsoft.NET.Test.Sdk from 17.2.0 to 17.3.0 by @dependabot in #465
• Add nullable annotations by @leastprivilege in #466
• Bump minver from 4.1.0 to 4.2.0 by @dependabot in #467
• Throw json parse exception on empty string by @rutgersc in #474
• Revert "Throw json parse exception on empty string" by @leastprivilege in #484
• Add DPoP related constants by @leastprivilege in #486
• Treat errors without an error message also as errors by @rutgersc in #487
• add unmet_authentication_requirements constant by @brockallen in #490
• Add constants for OIDC User Registration by @brockallen in #492
• Bump minver from 4.2.0 to 4.3.0 by @dependabot in #493
• Enforce form url encoded content type if needed by @leastprivilege in #485
• chore: fix link in comment by @AKomyshan in #496
• dpop constants by @brockallen in #499
• add dpop-nonce header constant by @brockallen in #501
• Add DynamicClientRegistrationSoftware Statement by @josephdecock in #502
• add support for dpop on token endpoint by @brockallen in #503
• remove unused variable by @brockallen in #504
• Update with some more dpop constants and helpers by @brockallen in #506
• Bump NuGetKeyVaultSignTool from 3.1.6 to 3.2.3 by @dependabot in #508
• Update build scripts by @leastprivilege in #509
• Add client metadata for dcr by @josephdecock in #511

New Contributors

• @ariveron made their first contribution in #463
• @MatthewSteeples made their first contribution in #460
• @rutgersc made their first contribution in #474
• @brockallen made their first contribution in #490
• @AKomyshan made their first contribution in #496
• @josephdecock made their first contribution in #502

Full Changelog: 6.0.0...6.1.0

What's Changed

• Rename property ExtensionData to Extensions by @vanillajonathan in #417
• Add software_id and software_version by @vanillajonathan in #418
• Bump Microsoft.NET.Test.Sdk from 16.11.0 to 17.0.0 by @dependabot in #421
• Bump Microsoft.SourceLink.GitHub from 1.0.0 to 1.1.0 by @dependabot in #425
• Bump Microsoft.SourceLink.GitHub from 1.1.0 to 1.1.1 by @dependabot in #427
• Add condition for testing targets on Apple M1 by @leastprivilege in #428
• Add CIBA support by @leastprivilege in #426
• Change default credential style to authorization header by @leastprivilege in #429
• Add documentation by @vanillajonathan in #419
• Change data type from string to Uri by @vanillajonathan in #413

Full Changelog: 5.2.0...6.0.0

Release to go along Duende IdentityServer v5

• removed all dependencies on JSON.NET
• re-worked internal parameter handling to allow multiple parameters of same type (required e.g. for resource parameter)

added an additional target for .NET 4.7.2

IdentityModel has been growing organically over the last years, and we felt it is necessary to do some fundamental cleanup. At the same time it is used by a lot of people and companies (currently around 20 million downloads on nuget) – which is a bit scary when doing breaking changes.

But since we are at a point where a new .NET Core runtime is released, and thus many other libraries will release new major version, we thought that this might be a good opportunity to make the changes.

This version is a breaking release!!!

Stay on v3.x if you are using:

• IdentityServer4 v2.x
• IdentityServer4.AccessTokenValidation v2.x
• IdentityModel.AspNetCore.OAuth2Introspection v3.x
• IdentityModel.OidcClient v2.x

All subsequent major versions of the above mentioned packages have switched to IdentityModel v4 and will be released along with IdentityServer4 v3 on the 23rd September.

In the coming days I will push IdentityModel v4 to nuget – here’s a high level list of the changes.

Target frameworks
I dropped the net452 target – v4 is targeting net461 and netstandard2.0 only.

Removed old *Client classes
I removed the protocol client classes like TokenClient in favour of the newer style extension methods for HttpMessageInvoker (the base class of HttpClient). This allows you to manage the setup and lifetime of the HTTP client yourself.
I added a new TokenClient and IntrospectionClient based on the new design which is now DI and HttpClientFactory friendly. I did that mainly because I needed them in some other project. Give them a try, and see if they work for you as well.

Removed access token related delegating handlers for HttpClient
I never was happy with their design, and they also did not work for some common scenarios. Part of the work has been moved to OidcClient (for native apps) and part of it has been moved to the ASP.NET Core specific IdentityModel.

Updated extension methods
The protocol extensions methods have been re-written from the ground up. The public API surface stayed mostly the same, but certain classes have been renamed for clarity.
The request objects now derive from HttpRequestMessage which gives you more control over the HTTP details (e.g. headers).

Updated Epoch Extensions
Year 2038 is coming! All extensions have been updated to use long instead of int. Alternatively – .NET has built-in support now as well. So feel free to switch to that if you like.

Misc
I probably changed some parameter, classes and namespace names..

• fix #157
• add authenticode signing.